Existing empirically robust defenses:  Some studies [1]}, [2]}, [3]} developed empirical defenses to mitigate adversarial examples in multi-label classification. For instance, Wu et al. [1]} applied adversarial training, a method developed to train robust multi-class classifiers, to improve the robustness of multi-label classifiers.
Melacci et al. [3]} showed that domain knowledge, which measures the relationships among classes, can be used to detect adversarial examples and improve the robustness of multi-label classifiers.
However, all these defenses lack provable robustness guarantees and thus, they are often broken by advanced adaptive attacks. For instance, Melacci et al. [3]} showed that their defenses can be broken by adaptive attacks that also consider the domain knowledge.
